amadey | ada8c049774d371aef00c629fa9b5fb5a365d73ecedd8bffd01bd74093c96e10

Analysis

max time kernel
112s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
24-03-2023 06:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7275be85fefccac07a264a7e5c927dfc.exe
Size

1.0MB
MD5

7275be85fefccac07a264a7e5c927dfc
SHA1

a3e7512c44935a36e94ae5eec74b3b0ad24fda40
SHA256

ada8c049774d371aef00c629fa9b5fb5a365d73ecedd8bffd01bd74093c96e10
SHA512

a3ce52cd6ea49b5c8af1289808bfad8ccad4ee1cfdf3144ac7ebf7c6f0cdb2e524ee8716fcdad40381bd69c03200275232cf8087e3a85a24689d3d6307645393
SSDEEP

24576:Vy7AeAEN4gpVkbzG47+PKwz+OL/z58W8qFSuUwT:w7AcpM/7CKwz+2L58WIu3

Score

10^/10

amadey redline down lown discovery evasion infostealer persistence spyware stealer trojan

Malware Config

Extracted

Family

redline

Botnet

down

193.233.20.31:4125

Attributes

auth_value
12c31a90c72f5efae8c053a0bd339381

Extracted

Family

redline

Botnet

lown

193.233.20.31:4125

Attributes

auth_value
4cf836e062bcdc2a4fdbf410f5747ec7

Extracted

Family

amadey

Version

3.68

62.204.41.87/joomla/index.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Modifies Windows Defender Real-time Protection settings 3 TTPs 12 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

tz8660.exev7601dg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	tz8660.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	v7601dg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	v7601dg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	tz8660.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	tz8660.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	tz8660.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	v7601dg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	v7601dg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	v7601dg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	v7601dg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	tz8660.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	tz8660.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 18 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1860-215-0x00000000028A0000-0x00000000028DE000-memory.dmp	family_redline
behavioral2/memory/1860-214-0x00000000028A0000-0x00000000028DE000-memory.dmp	family_redline
behavioral2/memory/1860-217-0x00000000028A0000-0x00000000028DE000-memory.dmp	family_redline
behavioral2/memory/1860-219-0x00000000028A0000-0x00000000028DE000-memory.dmp	family_redline
behavioral2/memory/1860-221-0x00000000028A0000-0x00000000028DE000-memory.dmp	family_redline
behavioral2/memory/1860-223-0x00000000028A0000-0x00000000028DE000-memory.dmp	family_redline
behavioral2/memory/1860-225-0x00000000028A0000-0x00000000028DE000-memory.dmp	family_redline
behavioral2/memory/1860-227-0x00000000028A0000-0x00000000028DE000-memory.dmp	family_redline
behavioral2/memory/1860-229-0x00000000028A0000-0x00000000028DE000-memory.dmp	family_redline
behavioral2/memory/1860-231-0x00000000028A0000-0x00000000028DE000-memory.dmp	family_redline
behavioral2/memory/1860-233-0x00000000028A0000-0x00000000028DE000-memory.dmp	family_redline
behavioral2/memory/1860-235-0x00000000028A0000-0x00000000028DE000-memory.dmp	family_redline
behavioral2/memory/1860-237-0x00000000028A0000-0x00000000028DE000-memory.dmp	family_redline
behavioral2/memory/1860-239-0x00000000028A0000-0x00000000028DE000-memory.dmp	family_redline
behavioral2/memory/1860-241-0x00000000028A0000-0x00000000028DE000-memory.dmp	family_redline
behavioral2/memory/1860-243-0x00000000028A0000-0x00000000028DE000-memory.dmp	family_redline
behavioral2/memory/1860-245-0x00000000028A0000-0x00000000028DE000-memory.dmp	family_redline
behavioral2/memory/1860-247-0x00000000028A0000-0x00000000028DE000-memory.dmp	family_redline

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

y13XW87.exelegenda.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	y13XW87.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	legenda.exe

Executes dropped EXE 11 IoCs

Processes:

zap0354.exezap3959.exezap8777.exetz8660.exev7601dg.exew94fc42.exexTMPe50.exey13XW87.exelegenda.exelegenda.exelegenda.exe

pid	process
636	zap0354.exe
3472	zap3959.exe
3652	zap8777.exe
900	tz8660.exe
4544	v7601dg.exe
1860	w94fc42.exe
1300	xTMPe50.exe
2200	y13XW87.exe
4212	legenda.exe
708	legenda.exe
4068	legenda.exe

Loads dropped DLL 1 IoCs

Processes:

rundll32.exe

pid process

4528 rundll32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
4528	rundll32.exe

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

tz8660.exev7601dg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	tz8660.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	v7601dg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	v7601dg.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

zap3959.exezap8777.exe7275be85fefccac07a264a7e5c927dfc.exezap0354.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	zap3959.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap8777.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup3 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP003.TMP\\\""	zap8777.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	7275be85fefccac07a264a7e5c927dfc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	7275be85fefccac07a264a7e5c927dfc.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap0354.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	zap0354.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	zap3959.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 2 IoCs

Processes:

WerFault.exeWerFault.exe

pid pid_target process target process

1400 4544 WerFault.exe v7601dg.exe
2216 1860 WerFault.exe w94fc42.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

4480 schtasks.exe
Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

tz8660.exev7601dg.exew94fc42.exexTMPe50.exe

pid process

900 tz8660.exe
900 tz8660.exe
4544 v7601dg.exe
4544 v7601dg.exe
1860 w94fc42.exe
1860 w94fc42.exe
1300 xTMPe50.exe
1300 xTMPe50.exe

pid	pid_target	process	target process
1400	4544	WerFault.exe	v7601dg.exe
2216	1860	WerFault.exe	w94fc42.exe

pid	process
4480	schtasks.exe

pid	process
900	tz8660.exe
900	tz8660.exe
4544	v7601dg.exe
4544	v7601dg.exe
1860	w94fc42.exe
1860	w94fc42.exe
1300	xTMPe50.exe
1300	xTMPe50.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

tz8660.exev7601dg.exew94fc42.exexTMPe50.exe

description	pid	process
Token: SeDebugPrivilege	900	tz8660.exe
Token: SeDebugPrivilege	4544	v7601dg.exe
Token: SeDebugPrivilege	1860	w94fc42.exe
Token: SeDebugPrivilege	1300	xTMPe50.exe

Suspicious use of WriteProcessMemory 53 IoCs

Processes:

7275be85fefccac07a264a7e5c927dfc.exezap0354.exezap3959.exezap8777.exey13XW87.exelegenda.execmd.exe

description	pid	process	target process
PID 4508 wrote to memory of 636	4508	7275be85fefccac07a264a7e5c927dfc.exe	zap0354.exe
PID 4508 wrote to memory of 636	4508	7275be85fefccac07a264a7e5c927dfc.exe	zap0354.exe
PID 4508 wrote to memory of 636	4508	7275be85fefccac07a264a7e5c927dfc.exe	zap0354.exe
PID 636 wrote to memory of 3472	636	zap0354.exe	zap3959.exe
PID 636 wrote to memory of 3472	636	zap0354.exe	zap3959.exe
PID 636 wrote to memory of 3472	636	zap0354.exe	zap3959.exe
PID 3472 wrote to memory of 3652	3472	zap3959.exe	zap8777.exe
PID 3472 wrote to memory of 3652	3472	zap3959.exe	zap8777.exe
PID 3472 wrote to memory of 3652	3472	zap3959.exe	zap8777.exe
PID 3652 wrote to memory of 900	3652	zap8777.exe	tz8660.exe
PID 3652 wrote to memory of 900	3652	zap8777.exe	tz8660.exe
PID 3652 wrote to memory of 4544	3652	zap8777.exe	v7601dg.exe
PID 3652 wrote to memory of 4544	3652	zap8777.exe	v7601dg.exe
PID 3652 wrote to memory of 4544	3652	zap8777.exe	v7601dg.exe
PID 3472 wrote to memory of 1860	3472	zap3959.exe	w94fc42.exe
PID 3472 wrote to memory of 1860	3472	zap3959.exe	w94fc42.exe
PID 3472 wrote to memory of 1860	3472	zap3959.exe	w94fc42.exe
PID 636 wrote to memory of 1300	636	zap0354.exe	xTMPe50.exe
PID 636 wrote to memory of 1300	636	zap0354.exe	xTMPe50.exe
PID 636 wrote to memory of 1300	636	zap0354.exe	xTMPe50.exe
PID 4508 wrote to memory of 2200	4508	7275be85fefccac07a264a7e5c927dfc.exe	y13XW87.exe
PID 4508 wrote to memory of 2200	4508	7275be85fefccac07a264a7e5c927dfc.exe	y13XW87.exe
PID 4508 wrote to memory of 2200	4508	7275be85fefccac07a264a7e5c927dfc.exe	y13XW87.exe
PID 2200 wrote to memory of 4212	2200	y13XW87.exe	legenda.exe
PID 2200 wrote to memory of 4212	2200	y13XW87.exe	legenda.exe
PID 2200 wrote to memory of 4212	2200	y13XW87.exe	legenda.exe
PID 4212 wrote to memory of 4480	4212	legenda.exe	schtasks.exe
PID 4212 wrote to memory of 4480	4212	legenda.exe	schtasks.exe
PID 4212 wrote to memory of 4480	4212	legenda.exe	schtasks.exe
PID 4212 wrote to memory of 3748	4212	legenda.exe	cmd.exe
PID 4212 wrote to memory of 3748	4212	legenda.exe	cmd.exe
PID 4212 wrote to memory of 3748	4212	legenda.exe	cmd.exe
PID 3748 wrote to memory of 1344	3748	cmd.exe	cmd.exe
PID 3748 wrote to memory of 1344	3748	cmd.exe	cmd.exe
PID 3748 wrote to memory of 1344	3748	cmd.exe	cmd.exe
PID 3748 wrote to memory of 1640	3748	cmd.exe	cacls.exe
PID 3748 wrote to memory of 1640	3748	cmd.exe	cacls.exe
PID 3748 wrote to memory of 1640	3748	cmd.exe	cacls.exe
PID 3748 wrote to memory of 1736	3748	cmd.exe	cacls.exe
PID 3748 wrote to memory of 1736	3748	cmd.exe	cacls.exe
PID 3748 wrote to memory of 1736	3748	cmd.exe	cacls.exe
PID 3748 wrote to memory of 1340	3748	cmd.exe	cmd.exe
PID 3748 wrote to memory of 1340	3748	cmd.exe	cmd.exe
PID 3748 wrote to memory of 1340	3748	cmd.exe	cmd.exe
PID 3748 wrote to memory of 4552	3748	cmd.exe	cacls.exe
PID 3748 wrote to memory of 4552	3748	cmd.exe	cacls.exe
PID 3748 wrote to memory of 4552	3748	cmd.exe	cacls.exe
PID 3748 wrote to memory of 1332	3748	cmd.exe	cacls.exe
PID 3748 wrote to memory of 1332	3748	cmd.exe	cacls.exe
PID 3748 wrote to memory of 1332	3748	cmd.exe	cacls.exe
PID 4212 wrote to memory of 4528	4212	legenda.exe	rundll32.exe
PID 4212 wrote to memory of 4528	4212	legenda.exe	rundll32.exe
PID 4212 wrote to memory of 4528	4212	legenda.exe	rundll32.exe

C:\Users\Admin\AppData\Local\Temp\7275be85fefccac07a264a7e5c927dfc.exe
"C:\Users\Admin\AppData\Local\Temp\7275be85fefccac07a264a7e5c927dfc.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4508

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap0354.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap0354.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:636

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap3959.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap3959.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3472

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap8777.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap8777.exe
4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3652

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz8660.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz8660.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:900

C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7601dg.exe
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7601dg.exe
5⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4544 -s 1092
6⤵
- Program crash
PID:1400

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w94fc42.exe
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w94fc42.exe
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1860

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 1912
5⤵
- Program crash
PID:2216

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xTMPe50.exe
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xTMPe50.exe
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1300

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y13XW87.exe
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y13XW87.exe
2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
"C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN legenda.exe /TR "C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe" /F
4⤵
- Creates scheduled task(s)
PID:4480

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "legenda.exe" /P "Admin:N"&&CACLS "legenda.exe" /P "Admin:R" /E&&echo Y|CACLS "..\f22b669919" /P "Admin:N"&&CACLS "..\f22b669919" /P "Admin:R" /E&&Exit
4⤵
- Suspicious use of WriteProcessMemory
PID:3748

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:1344

C:\Windows\SysWOW64\cacls.exe
CACLS "legenda.exe" /P "Admin:N"
5⤵
PID:1640

C:\Windows\SysWOW64\cacls.exe
CACLS "legenda.exe" /P "Admin:R" /E
5⤵
PID:1736

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
5⤵
PID:1340

C:\Windows\SysWOW64\cacls.exe
CACLS "..\f22b669919" /P "Admin:N"
5⤵
PID:4552

C:\Windows\SysWOW64\cacls.exe
CACLS "..\f22b669919" /P "Admin:R" /E
5⤵
PID:1332

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll, Main
4⤵
- Loads dropped DLL
PID:4528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4544 -ip 4544
1⤵
PID:892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1860 -ip 1860
1⤵
PID:776

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
1⤵
- Executes dropped EXE
PID:708

C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
1⤵
- Executes dropped EXE
PID:4068

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y13XW87.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\y13XW87.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap0354.exe
Filesize
843KB

MD5
b6f1cf55bad8cf5291be948a9e4c3af5

SHA1
8150275223a34aedfa29e6e1d6ea84bbd555797b

SHA256
994d2a5f42b42e6b76650352a8e6cdc53a170c921f14dda2898dcba81b7d96a6

SHA512
d3b42326b576d3281c9d5e1140e9a45ea2d75804c9d3e86d6dd02b74b0a1978f51ba9df5d1c6ef1e86623bc308210ad4243866b89acd8262115d26c430bba068

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\zap0354.exe
Filesize
843KB

MD5
b6f1cf55bad8cf5291be948a9e4c3af5

SHA1
8150275223a34aedfa29e6e1d6ea84bbd555797b

SHA256
994d2a5f42b42e6b76650352a8e6cdc53a170c921f14dda2898dcba81b7d96a6

SHA512
d3b42326b576d3281c9d5e1140e9a45ea2d75804c9d3e86d6dd02b74b0a1978f51ba9df5d1c6ef1e86623bc308210ad4243866b89acd8262115d26c430bba068

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xTMPe50.exe
Filesize
175KB

MD5
50809fe16d7c482c1f4a2ea19fdcbc0a

SHA1
11b6f69c06a724da15183b16039c5cbc86016158

SHA256
09917b67829de37b5d6be8115c8f8321f436554f426a24e079257a8368051cb1

SHA512
c35170e5eb6dabda9fd2d289153df829957ca8e9665178529a1ba36395155bb34f489372993ec694d10bea490c86cef2ae152e2df480288aca8e796ba135261f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\xTMPe50.exe
Filesize
175KB

MD5
50809fe16d7c482c1f4a2ea19fdcbc0a

SHA1
11b6f69c06a724da15183b16039c5cbc86016158

SHA256
09917b67829de37b5d6be8115c8f8321f436554f426a24e079257a8368051cb1

SHA512
c35170e5eb6dabda9fd2d289153df829957ca8e9665178529a1ba36395155bb34f489372993ec694d10bea490c86cef2ae152e2df480288aca8e796ba135261f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap3959.exe
Filesize
701KB

MD5
8a0062dc5c90a85e7c59a30d0207d7db

SHA1
ec0b1b36fd0e188e1006f8e1cb97a0c6228bae7b

SHA256
5ee2607b51b5de8de7136c068ee11a2be1a83b7c6ecdf89314ac7421db5b17c8

SHA512
ff6711ea64762cec4d4f28f66e0ca48384f939653ddf206d37d10ef50e7ac8c5f8881c367e038c4cf89195b8c1c877636c85a31eca193fef7affda408c5e452f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\zap3959.exe
Filesize
701KB

MD5
8a0062dc5c90a85e7c59a30d0207d7db

SHA1
ec0b1b36fd0e188e1006f8e1cb97a0c6228bae7b

SHA256
5ee2607b51b5de8de7136c068ee11a2be1a83b7c6ecdf89314ac7421db5b17c8

SHA512
ff6711ea64762cec4d4f28f66e0ca48384f939653ddf206d37d10ef50e7ac8c5f8881c367e038c4cf89195b8c1c877636c85a31eca193fef7affda408c5e452f

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w94fc42.exe
Filesize
358KB

MD5
0986a56086f7aa01e7ad71fa6a2c4534

SHA1
bb69ff83680965d95c20b5349f3165f0cc0ea550

SHA256
c1e5de91cfcfe5d691581650e753d7da170f63512572b91a0b3007649321f20b

SHA512
54a01b171c44f6b7047417457797330e90ca0887460ab44ca06f821c01eca1be1d0ea472b2a04aefba36ea327ca4ecebe3f8bc8774ee2064166ca69fc81a5a7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\w94fc42.exe
Filesize
358KB

MD5
0986a56086f7aa01e7ad71fa6a2c4534

SHA1
bb69ff83680965d95c20b5349f3165f0cc0ea550

SHA256
c1e5de91cfcfe5d691581650e753d7da170f63512572b91a0b3007649321f20b

SHA512
54a01b171c44f6b7047417457797330e90ca0887460ab44ca06f821c01eca1be1d0ea472b2a04aefba36ea327ca4ecebe3f8bc8774ee2064166ca69fc81a5a7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap8777.exe
Filesize
346KB

MD5
945660c0d1e12e51f45a4fcd76f51818

SHA1
5206894d58a08814322bf2b1f225d781f27fb6de

SHA256
0bb1ee81f33477d8632aba1a9c7719eee06dc3328dfe5801c30859a61e0e5295

SHA512
09b361a972ac2ebbf1ef40f6f5be98803288b8410c57cab26bd205e3a87eff2cb2349506a147af85bedd3a8ac9474b77464b5d9073584e1f831563d520d62f12

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\zap8777.exe
Filesize
346KB

MD5
945660c0d1e12e51f45a4fcd76f51818

SHA1
5206894d58a08814322bf2b1f225d781f27fb6de

SHA256
0bb1ee81f33477d8632aba1a9c7719eee06dc3328dfe5801c30859a61e0e5295

SHA512
09b361a972ac2ebbf1ef40f6f5be98803288b8410c57cab26bd205e3a87eff2cb2349506a147af85bedd3a8ac9474b77464b5d9073584e1f831563d520d62f12

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz8660.exe
Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\tz8660.exe
Filesize
11KB

MD5
7e93bacbbc33e6652e147e7fe07572a0

SHA1
421a7167da01c8da4dc4d5234ca3dd84e319e762

SHA256
850cd190aaeebcf1505674d97f51756f325e650320eaf76785d954223a9bee38

SHA512
250169d7b6fcebff400be89edae8340f14130ced70c340ba9da9f225f62b52b35f6645bfb510962efb866f988688cb42392561d3e6b72194bc89d310ea43aa91

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7601dg.exe
Filesize
300KB

MD5
647f81f27a00e5518d2b8664fd36892c

SHA1
6f26915531e01896f12d88ffce6834a0d651d2c4

SHA256
f23182bc3ce8de9b2738ca0f233adfa41442480413dff05fe7489276186be696

SHA512
aec1663978a04da8b1e9125f44e85317ca2cb55c3cf310d187f6b6558f05dfe7cab4b394a1801cfaa3c3801ca8717e96d76ddcf97c7d5349ab2f791d0309ec24

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP003.TMP\v7601dg.exe
Filesize
300KB

MD5
647f81f27a00e5518d2b8664fd36892c

SHA1
6f26915531e01896f12d88ffce6834a0d651d2c4

SHA256
f23182bc3ce8de9b2738ca0f233adfa41442480413dff05fe7489276186be696

SHA512
aec1663978a04da8b1e9125f44e85317ca2cb55c3cf310d187f6b6558f05dfe7cab4b394a1801cfaa3c3801ca8717e96d76ddcf97c7d5349ab2f791d0309ec24

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\f22b669919\legenda.exe
Filesize
235KB

MD5
5086db99de54fca268169a1c6cf26122

SHA1
003f768ffcc99bda5cda1fb966fda8625a8fdc3e

SHA256
42873b0c5899f64b5f3205a4f3146210cc63152e529c69d6292b037844c81ec4

SHA512
90531b1b984b21ce62290b713ffc07917bbd766eef7d5e6f4c1c68b2fc7d29495cdd5f05fd71fe5107f1614bbb30922dcfb730f50599e44aeaff52c50f46b8b5

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\clip64.dll
Filesize
89KB

MD5
16cf28ebb6d37dbaba93f18320c6086e

SHA1
eae7d4b7a9636329065877aabe8d4f721a26ab25

SHA256
c0603ed73299e59dc890ae194c552acd9d8a2aef2e1a9e76346ca672e3b14106

SHA512
f8eee1d4142483de223ddbefec43023fd167e41e358bf8994140e2dcc1712f49228dc92e4e237d1df4ffa6c948097a8309c84d60788a03babed668532c438fc2

Download Submit
C:\Users\Admin\AppData\Roaming\a091ec0a6e2227\cred64.dll
Filesize
223B

MD5
94cbeec5d4343918fd0e48760e40539c

SHA1
a049266c5c1131f692f306c8710d7e72586ae79d

SHA256
48eb3ca078da2f5e9fd581197ae1b4dfbac6d86040addbb305e305c014741279

SHA512
4e92450333d60b1977f75c240157a8589cfb1c80a979fbe0793cc641e13556004e554bc6f9f4853487dbcfcdc2ca93afe610649e9712e91415ed3f2a60d4fec0

Download Submit
memory/900-161-0x0000000000070000-0x000000000007A000-memory.dmp

Filesize
40KB

Download
memory/1300-1141-0x0000000000EA0000-0x0000000000ED2000-memory.dmp

Filesize
200KB

Download
memory/1300-1142-0x0000000005720000-0x0000000005730000-memory.dmp

Filesize
64KB

Download
memory/1860-1126-0x0000000005FF0000-0x0000000006056000-memory.dmp

Filesize
408KB

Download
memory/1860-247-0x00000000028A0000-0x00000000028DE000-memory.dmp

Filesize
248KB

Download
memory/1860-1135-0x0000000004EE0000-0x0000000004EF0000-memory.dmp

Filesize
64KB

Download
memory/1860-1134-0x00000000070F0000-0x0000000007140000-memory.dmp

Filesize
320KB

Download
memory/1860-1133-0x0000000007070000-0x00000000070E6000-memory.dmp

Filesize
472KB

Download
memory/1860-1132-0x0000000004EE0000-0x0000000004EF0000-memory.dmp

Filesize
64KB

Download
memory/1860-1131-0x0000000004EE0000-0x0000000004EF0000-memory.dmp

Filesize
64KB

Download
memory/1860-1130-0x0000000004EE0000-0x0000000004EF0000-memory.dmp

Filesize
64KB

Download
memory/1860-1128-0x00000000069F0000-0x0000000006F1C000-memory.dmp

Filesize
5.2MB

Download
memory/1860-1127-0x0000000006810000-0x00000000069D2000-memory.dmp

Filesize
1.8MB

Download
memory/1860-210-0x00000000007B0000-0x00000000007FB000-memory.dmp

Filesize
300KB

Download
memory/1860-211-0x0000000004EE0000-0x0000000004EF0000-memory.dmp

Filesize
64KB

Download
memory/1860-212-0x0000000004EE0000-0x0000000004EF0000-memory.dmp

Filesize
64KB

Download
memory/1860-213-0x0000000004EE0000-0x0000000004EF0000-memory.dmp

Filesize
64KB

Download
memory/1860-215-0x00000000028A0000-0x00000000028DE000-memory.dmp

Filesize
248KB

Download
memory/1860-214-0x00000000028A0000-0x00000000028DE000-memory.dmp

Filesize
248KB

Download
memory/1860-217-0x00000000028A0000-0x00000000028DE000-memory.dmp

Filesize
248KB

Download
memory/1860-219-0x00000000028A0000-0x00000000028DE000-memory.dmp

Filesize
248KB

Download
memory/1860-221-0x00000000028A0000-0x00000000028DE000-memory.dmp

Filesize
248KB

Download
memory/1860-223-0x00000000028A0000-0x00000000028DE000-memory.dmp

Filesize
248KB

Download
memory/1860-225-0x00000000028A0000-0x00000000028DE000-memory.dmp

Filesize
248KB

Download
memory/1860-227-0x00000000028A0000-0x00000000028DE000-memory.dmp

Filesize
248KB

Download
memory/1860-229-0x00000000028A0000-0x00000000028DE000-memory.dmp

Filesize
248KB

Download
memory/1860-231-0x00000000028A0000-0x00000000028DE000-memory.dmp

Filesize
248KB

Download
memory/1860-233-0x00000000028A0000-0x00000000028DE000-memory.dmp

Filesize
248KB

Download
memory/1860-235-0x00000000028A0000-0x00000000028DE000-memory.dmp

Filesize
248KB

Download
memory/1860-237-0x00000000028A0000-0x00000000028DE000-memory.dmp

Filesize
248KB

Download
memory/1860-239-0x00000000028A0000-0x00000000028DE000-memory.dmp

Filesize
248KB

Download
memory/1860-241-0x00000000028A0000-0x00000000028DE000-memory.dmp

Filesize
248KB

Download
memory/1860-243-0x00000000028A0000-0x00000000028DE000-memory.dmp

Filesize
248KB

Download
memory/1860-245-0x00000000028A0000-0x00000000028DE000-memory.dmp

Filesize
248KB

Download
memory/1860-1125-0x0000000005F50000-0x0000000005FE2000-memory.dmp

Filesize
584KB

Download
memory/1860-1120-0x00000000054A0000-0x0000000005AB8000-memory.dmp

Filesize
6.1MB

Download
memory/1860-1121-0x0000000005B00000-0x0000000005C0A000-memory.dmp

Filesize
1.0MB

Download
memory/1860-1122-0x0000000005C40000-0x0000000005C52000-memory.dmp

Filesize
72KB

Download
memory/1860-1123-0x0000000005C60000-0x0000000005C9C000-memory.dmp

Filesize
240KB

Download
memory/1860-1124-0x0000000004EE0000-0x0000000004EF0000-memory.dmp

Filesize
64KB

Download
memory/4544-188-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/4544-205-0x0000000000400000-0x000000000070E000-memory.dmp

Filesize
3.1MB

Download
memory/4544-198-0x0000000002790000-0x00000000027A0000-memory.dmp

Filesize
64KB

Download
memory/4544-197-0x0000000002790000-0x00000000027A0000-memory.dmp

Filesize
64KB

Download
memory/4544-186-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/4544-204-0x0000000002790000-0x00000000027A0000-memory.dmp

Filesize
64KB

Download
memory/4544-203-0x0000000002790000-0x00000000027A0000-memory.dmp

Filesize
64KB

Download
memory/4544-184-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/4544-200-0x0000000000400000-0x000000000070E000-memory.dmp

Filesize
3.1MB

Download
memory/4544-199-0x0000000002790000-0x00000000027A0000-memory.dmp

Filesize
64KB

Download
memory/4544-192-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/4544-190-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/4544-196-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/4544-194-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/4544-202-0x0000000002790000-0x00000000027A0000-memory.dmp

Filesize
64KB

Download
memory/4544-182-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/4544-180-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/4544-178-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/4544-176-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/4544-174-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/4544-172-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/4544-170-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/4544-169-0x0000000002810000-0x0000000002822000-memory.dmp

Filesize
72KB

Download
memory/4544-168-0x0000000004D70000-0x0000000005314000-memory.dmp

Filesize
5.6MB

Download
memory/4544-167-0x0000000000780000-0x00000000007AD000-memory.dmp

Filesize
180KB

Download